BeyondTrust suspects Armory Castle uses AI to model target products for exploit development
Armory Castle began exploiting BeyondTrust zero-day CVE-2026-102764 on August 29, 2026.
zero-day
Our coverage: 37 reports since October 8, 2026. Latest: BeyondTrust suspects Armory Castle uses AI to model target products for exploit development, October 18, 2026.
-
-
FBI arrests ransomware negotiator Dubrovsky before Philadelphia Cyber Risk Summit on Oct. 8, 2026
Senior DOJ officials described the Martino case as significant and are considering roundtables with cybersecurity firms to discuss insider‑threat prevention.
-
TP‑Link releases firmware fixing six flaws in Tapo C200 V5 and C120 V1
Combining the authentication bypass and command‑injection flaws lets attackers on the same network gain admin access and run commands.
-
China-linked espionage group exploited BeyondTrust zero-day in Remote Support appliances
Armory Castle, tracked by Mandiant and Google Threat Intelligence, used the flaw starting August 29 to deploy backdoors and harvest credentials, with patches now available.
-
Drupal patches two critical RCE flaws affecting all supported versions
Patched releases include Drupal core 10.6.19, 11.3.19, 11.4.10 and Entity List module 3.0.10.
-
Armory Castle escalates BeyondTrust zero-day exploitation with credential theft and lateral movement
Google warns of continued targeting of edge devices as the group deploys webshells, backdoors and SOCKS5 tunneling after patch release
-
Israeli ad-tech firm used targeted ads to deliver Candiru spyware without user interaction
Citizen Lab confirms AdFection as the first zero-click spyware delivery method via ads, linked to 45 infected Al Jazeera devices between 2024 and 2025
-
China-linked Armory Castle hijacks BeyondTrust Remote Support Servers via zero-day since August
The espionage group exploited CVE-2026-102764 to deploy custom malware, harvest credentials, and evade detection across enterprise networks, researchers say
-
XBOW gets $250,000 Google Chrome bounty for billion‑user exploit
Researchers demonstrated a proof‑of‑concept industrial control systems (ICS)‑Sniper attack that analyzes virtual private network (VPN)-encrypted packet metadata to time packet drops and disrupt operations on a SWaT water‑treatment testbed
-
At least 45 Al Jazeera journalists devices infected via zero click malicious ads
The spyware required no interaction from victims and was delivered through an israeli ad tech platform
-
Microsoft Patch Tuesday fixes over 1,400 CVEs, CISA warns of Ivanti Zero-Day
CISA instructed federal civilian agencies to patch Ivanti Connect Secure vulnerability CVE-2026-104935 by Friday and to address Windows Shell bypass CVE-2026-96951 by Oct. 16, 2026.
-
Microsoft patches record 1,413 flaws in October Patch Tuesday
The update fixed an actively exploited Windows Shell zero‑day (a flaw exploited before a patch is available), CVE-2026-96951, rated CVSS 8.8 (a common severity scoring system).